Buggy code:
public static class StatusCode { public static final int OK = 200 ; public static final int CREATED = 201 ; public static final int ACCEPTED = 202 ; public static final int PARTIAL_INFO = 203 ; public static final int NO_RESPONSE = 204 ; public static final int MOVED = 301 ; public static final int FOUND = 302 ; public static final int METHOD = 303 ; public static final int NOT_MODIFIED = 304 ; public static final int BAD_REQUEST = 400 ; public static final int UNAUTHORIZED = 401 ; public static final int PAYMENT_REQUIRED = 402 ; public static final int FORBIDDEN = 403 ; public static final int NOT_FOUND = 404 ; public static final int INTERNAL_ERROR = 500 ; public static final int NOT_IMPLEMENTED = 501 ; public static final int OVERLOADED = 502 ; public static final int GATEWAY_TIMEOUT = 503 ; public static boolean success ( int code ) { } public static boolean redirect ( int code ) { } public static boolean error ( int code ) { } } public static class Header implements Serializable { public String name ; public List < String > values ; public Header ( ) { } public Header ( String name , String value ) { } public Header ( String name , List < String > values ) { } public String value ( ) { } @ Override public String toString ( ) { } } public static class Cookie implements Serializable { public static String defaultDomain = null ; public String name ; public String domain ; public String path = ( Play . ctxPath ) + "//" ; public boolean secure = false ; public String value ; public Integer maxAge ; public boolean sendOnError = false ; public boolean httpOnly = false ; } public static class Request implements Serializable { public String host ; public String path ; public String querystring ; public String url ; public String method ; public String domain ; public String remoteAddress ; public String contentType ; public String encoding = Play . defaultWebEncoding ; public String controller ; public String actionMethod ; public Integer port ; public Boolean secure = false ; public Map < String , Http . Header > headers = null ; public Map < String , Http . Cookie > cookies = null ; public transient InputStream body ; public Map < String , String > routeArgs ; public String format = null ; public String action ; public static ThreadLocal < Http . Request > current = new ThreadLocal < Http . Request > ( ) ; public transient Method invokedMethod ; public transient Class < ? extends Controller > controllerClass ; public Map < String , Object > args = new HashMap < String , Object > ( 16 ) ; public Date date = new Date ( ) ; public boolean isNew = true ; public String user ; public String password ; public boolean isLoopback ; boolean resolved ; public final Params params = new Scope . Params ( ) ; @ Deprecated public Request ( ) { } public static Http . Request createRequest ( String _remoteAddress , String _method , String _path , String _querystring , String _contentType , InputStream _body , String _url , String _host , boolean _isLoopback , int _port , String _domain , boolean _secure , Map < String , Http . Header > _headers , Map < String , Http . Cookie > _cookies ) { } protected void parseXForwarded ( ) { if ( ( configuration . containsKey ( "XForwardedSupport" ) ) && ( ( headers . get ( "x-forwarded-for" ) ) != null ) ) { <START_BUG> if ( ! ( Arrays . asList ( configuration . getProperty ( "XForwardedSupport" , "127.0.0.1" ) . split ( "," ) ) . contains ( remoteAddress ) ) ) { <END_BUG> throw new RuntimeException ( ( "This<seq2seq4repair_space>proxy<seq2seq4repair_space>request<seq2seq4repair_space>is<seq2seq4repair_space>not<seq2seq4repair_space>authorized:<seq2seq4repair_space>" + ( remoteAddress ) ) ) ; } else { secure = isRequestSecure ( ) ; if ( configuration . containsKey ( "XForwardedHost" ) ) { host = ( ( String ) ( configuration . get ( "XForwardedHost" ) ) ) ; } else if ( ( headers . get ( "x-forwarded-host" ) ) != null ) { host = headers . get ( "x-forwarded-host" ) . value ( ) ; } if ( ( headers . get ( "x-forwarded-for" ) ) != null ) { remoteAddress = headers . get ( "x-forwarded-for" ) . value ( ) ; } } } } private boolean isRequestSecure ( ) { } @ Deprecated public void _init ( ) { } protected void authorizationInit ( ) { } public void resolveFormat ( ) { } public static Http . Request current ( ) { } public Http . Request get ( ) { } public boolean isAjax ( ) { } public String getBase ( ) { } @ Override public String toString ( ) { } public List < String > acceptLanguage ( ) { } public boolean isModified ( String etag , long last ) { } } public static class Response { public Integer status = 200 ; public String contentType ; public Map < String , Http . Header > headers = new HashMap < String , Http . Header > ( 16 ) ; public Map < String , Http . Cookie > cookies = new HashMap < String , Http . Cookie > ( 16 ) ; public ByteArrayOutputStream out ; public Object direct ; public String encoding = Play . defaultWebEncoding ; public static ThreadLocal < Http . Response > current = new ThreadLocal < Http . Response > ( ) ; public static Http . Response current ( ) { } public String getHeader ( String name ) { } public void setHeader ( String name , String value ) { } public void setContentTypeIfNotSet ( String contentType ) { }

Fix:
if ( ( ! ( "all" . equals ( configuration . getProperty ( "XForwardedSupport" , "127.0.0.1" ) ) ) ) && ( ! ( Arrays . asList ( configuration . getProperty ( "XForwardedSupport" , "127.0.0.1" ) . split ( "," ) ) . contains ( remoteAddress ) ) ) ) {